Payload CMS: Remote code execution through first-register endpoint

Summary

Payload is an open-source headless content management system. In affected versions, a crafted request to the public first-register operation can execute code remotely on the server. The attack requires local authentication to be enabled and no initial user to have been created yet; the attacker needs no prior login.

Affected

• Payload 3.x below 3.90.0
• Payload 4.0 canary versions from 4.0.0-canary.0 up to (excluding) 4.0.0-canary.34

Fixed in

• Payload 3.90.0
• Payload 4.0.0-canary.34

Workaround

• Unknown from the vendor. The vendor advisory only recommends upgrading.
• Unverified third-party suggestions: restrict the public first-register endpoint or limit it to authenticated admins; or create the initial user before exposing the application.

Exploitation

• CISA KEV: not listed.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found in a non-exhaustive search.

Our recommendation

• Check immediately whether any internet-facing Payload instance is below 3.90.0 or 4.0.0-canary.34.
• Upgrade all Payload packages to 3.90.0 or 4.0.0-canary.34 (or a later patched version) and update the packages together.
• Confirm that an admin user exists; if none exists, create one immediately after the upgrade.
• Review logs for unexpected requests to the first-register endpoint and for unknown user accounts.
• Pay special attention to newly deployed or reinstalled instances and to instances where the database was reset.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-97rh-rhh2-7vjv github.com
• Payload v3.90.0 release github.com
• Fix commit e947fc4 github.com
• Payload security update payloadcms.com
• OSV GHSA-97rh-rhh2-7vjv osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:47.